ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants
AI-summarised brief · reviewed before publication
ConnectWise disclosed that on October 17, 2026 it disabled seven of its application identities after unknown threat actors accessed those identities and compromised multiple Microsoft 365 tenants. The company revoked the certificates used for Cloud Backup connections, halting new authentications and suspending scheduled backups, though existing encrypted archives remain intact. Attackers leveraged the stolen application credentials to request access tokens from Microsoft Entra ID, potentially gaining rights to mailboxes, SharePoint, Teams and directory data, and could elevate privileges to Global Administrator or create new trusted applications for persistence. ConnectWise identified the breach on October 14 through its monitoring systems, initiated internal and external investigations, and has temporarily taken SaaS Security and Cloud Management offline while remediation continues. No evidence yet shows that backup archives were accessed.
💡 Why It Matters
- · By hijacking a single set of application credentials, attackers could infiltrate dozens of customer Microsoft 365 environments without individual passwords, turning a supply‑chain weakness into a broad, stealthy intrusion vector.
